Skip to main content
mySites.guru

Active Joomla Extension security alerts: Thirteen vulnerabilities found this monthDPCalendarJCERSFilesQuixSP Page Builder

Legal

Privacy Policy

How mySites.guru handles your personal data, the vendors we use, and your rights under GDPR.

Last updated: 23 April 2026

What we store, and why it’s safe

We hold as little of your personal data as possible, keep what we do hold encrypted, and don’t share it.

Most of what mySites.guru stores about your sites is integers and a handful of strings, such as the platform name or a preference value. When you revoke our access or cancel, your sites keep working exactly as before, because we don’t own your data and never did.

We are registered with two Information Commissioners (UK and Jersey, Channel Islands), our connector is open source and GPL-licensed, and we’ve operated under these rules for over a decade.

Questions? Get in touch. A human replies.

Vendors we use

Being listed here doesn’t mean we share your data with them. This is the complete list of third-party vendors we integrate with to run the service. We send the minimum amount of data needed, and only when needed, and only when you opt into certain features such as AI analysis or Client Reports.

Not all of what we pass is Personal Data (as defined by GDPR and UK data protection law). A lot of it is technical, anonymous, or plain binary, such as version numbers, counts, flags, and hashes.

1. Awareness

Everyone building and running mySites.guru is GDPR-aware. The service is owned by Blue Flame Digital Solutions, a UK company.

Code deployed to any platform is reviewed by the Data Controller named below. That’s a second pair of human eyes on every change, whether the author is staff or a contractor.

2. Information we hold

We store the minimum needed to run the service, covering two groups:

  • 2.1 Customers (the operators using mySites.guru)
  • 2.2 Customers’ Joomla and WordPress sites (your end users)

We don’t share or resell any user data beyond what’s described on this page.

2.1 Information held on our users

What we collect

Strictly what the service needs:

  • Email address
  • First and last name
  • Full invoice address
  • VAT number, country, and status
  • Social login IDs (Google, GitHub, Facebook) if you use them
  • Twitter name (deprecated, retained for old accounts)
  • IP address and timezone
  • Card details including optional billing address (handled by Stripe)
  • Username and password (one-way hashed, never stored in plain text)
All personal data is encrypted at rest in our database.

Who collects it

mySites.guru, controlled by the Data Controller listed below.

How

You enter it during sign-up and while using the service. Submitting it is how you grant consent to process it. A handful of third parties such as MailChimp enrich it with metadata like your mail client when they serve our email.

Why

To provide the service you signed up for: authentication, billing, debugging, and anonymous stats we use to improve the product.

Who we share it with

The full list is in the Vendors we use section above.

Likely effect

The service runs, billing automates, and you can unsubscribe from any mailings at any time.

3. Communicating privacy information

This page is it.

Everything we have to say on the matter lives here, and we keep it current.

4. Your rights under GDPR

Right to be informed
This page. You’re reading it.
Right of access
Everything we hold on you is in your mySites.guru account and exportable on demand from your account privacy page.
Right of rectification
Contact us and we’ll update it.
Right of erasure
Contact us. We’ll act within legal timescales.
Right to restrict processing
We only process the data described on this page.
Right to data portability
Use the Export button in your account, any time.
Right to object
Contact us.
Right not to be subject to automated decision-making or profiling
We don’t do that, and we never will.

5. Subject access requests

We reply to every access request, yes or no, within a week. The legal limit is one month. Free for paid and free accounts alike.

Or skip the queue and export your personal data yourself from your mySites.guru account. Same information, instant.

6. Lawful basis for processing

Data we hold is based on consent you gave by signing up, plus the logged interactions showing your ongoing use of the account.

Connecting a site to mySites.guru is a deliberate, multi-step action by a site super-admin who is also the account holder. That act grants consent for us to use the connector and process the data we need to deliver the service.

Signing up adds you to the mailing list. You can change what we send you at any time in your notification preferences.

Retaining a minimal record to defend the platform

You may have the right to be forgotten, but we keep the right to defend ourselves and our platform.

mySites.guru is a technical service that makes effectively unlimited automated HTTP calls to remote servers and websites on behalf of our users, around the clock. Because that activity reaches other people’s infrastructure, we and our users have to be able to stand behind it. If it is ever challenged, whether by a genuine legal query, attack or lawsuit, or by a malicious accusation, we must be able to show what was done, when, and by whom, and defend both our own actions and those of our users.

As a business-to-business service we hold very little personal data, and only what you gave us. This may include any name, moniker or username provided to us by you, your email address and IP addresses. Even after a deletion request, we reserve the right to retain that minimal amount where we genuinely need it to:

  • Defend against legal claims, and prove who used the platform. We connect to remote servers and websites on your instruction, so if law enforcement or a court asks, we have to be able to show who made a given request, including handing our logs to a court if we are lawfully ordered to.
  • Prevent and prove fraud, both financial and technical. Financial such as card testing and card washing; technical such as proving whether our platform was, or was not, used in a cyber attack, and by whom, or defending an accusation or claim of defamation arising from it.
  • Protect ourselves and our other customers from repeated abuse, such as personal attacks or the abuse of free trials.

Where we retain data after a deletion request we apply strict data minimisation and strict confidentiality. The personal data we keep (any name, moniker or username you provided, your email address and IP addresses) stays fully encrypted and at rest, is not accessed unless one of the situations above actually arises, and is removed entirely once we are satisfied that no further abuse, fraud or legal defence is possible.

Some of the technical data we keep is stored only as a blind hash, not as encrypted data. A blind hash is a one-way fingerprint: we cannot reverse it to recover the original value, we can only re-hash a value supplied to us in future and check whether it matches. Domain names previously connected to the service are held this way, and IP addresses may also be blind-hashed after a period of time to anonymise them. This lets us protect every user and the platform from abuse (for example, stopping a locked domain from being re-added, or recognising a repeat abuser by IP) without keeping the original values in any recoverable form. Hashing is not encryption: for this data we hold only the hash, never an encrypted copy of the original.

This is permitted under GDPR: the right to erasure does not apply where holding the data is necessary to establish, exercise or defend a legal claim (Article 17(3)), and we rely on our legitimate interests in preventing fraud and abuse (Article 6(1)(f)). Relying on these does not exempt us from the rest of GDPR, so we still minimise what we hold and keep it confidential and secure.

7. Consent

Consent is explicit: you give it when you enter data, or when you install the mySites.guru connector on a site you run.

We never source personal data from anywhere else, manually or automatically. You give us the data, or we don’t have it.

Connecting a site grants ongoing consent for the connector to operate. We don’t prompt you each time it runs.

8. Children

mySites.guru is a business-to-business service and isn’t offered to children. We don’t age-gate sign-up.

9. Data breaches

We actively monitor for unauthorised access and harden our systems continuously to reduce the attack surface.

Since mySites.guru launched, we’ve had zero major security incidents and one minor theoretical issue, fixed the same day it was reported, with no data exposure.

Security reports go to phil@phil-taylor.com. We process them same-day and pay bounties for valid findings.

What we do to reduce the attack surface

  • Aggressive firewalls and network isolation throughout the infrastructure.
  • No public internet access to our servers. Only Phil Taylor can reach the live platform.
  • We track CVEs in every library we depend on and patch as soon as fixes land.
  • 2FA on every sensitive third-party account.
  • Data stores and sensitive backends live on separate servers behind separate firewalls.
  • Backups run every 3 hours, GPG-encrypted, held for at most one month, stored off-site.
  • Encryption keys live on different physical hardware to the database.
  • Multiple systems would have to be hacked, and encryption broken, to issue a single valid request to a connected site.
If a breach ever happens, we’ll notify you within 24 hours of knowing and fixing it. You’re then responsible for telling your end-users in good time.

10. Data protection by design

Security comes first when we design anything new. We protect the integrity of the system, then the data it stores.

Our engineers know software and network security well. That shapes the architecture before a line of code is written.

11. Data Controller

Under GDPR we operate with a Data Controller rather than a Data Protection Officer:

Phil Taylor
CEO, CTO, lead developer, owner
C803 W3, Westmount, St Helier, Jersey, JE2 3BL

12. International

mySites.guru may, through its users, process data from individuals across the EU.

The service is run by Blue Flame Digital Solutions Limited, a UK company managed from Jersey, Channel Islands (outside the EU). Our main establishment is Jersey, so our supervisory authority sits there, and the UK’s Information Commissioner also applies.

Blue Flame Digital Solutions Limited is registered with the UK Information Commissioner and the Jersey Information Commissioner, and fully complies with the Data Protection (Jersey) Law 2018.

Any other questions? Ask us.